The present invention relates to network security systems. More particularly, the present invention relates to vulnerability detection systems, intrusion detection systems, communication between the two, and query-based rules for identifying vulnerabilities and detecting intrusion.
Computer networks are vulnerable to many threats that can inflict damage that can result in significant losses. These losses can stem from a number of sources including environmental hazards, hardware and software failure, user errors, or even malicious acts of others. A goal of network security is therefore to protect the confidentiality, integrity, and availability of information stored electronically in a network from these threatening sources.
Several conventional resources are available to protect a network from information losses. For instance, firewalls are used between two or more networks to filter incoming traffic (generally from the Internet) according to a security policy. Still, firewalls are inadequate to protect a network fully since users may not always obtain access to a network through the Internet (for instance, a user could circumnavigate the firewall by using a modem connection). In addition to the many ways a network can be attacked externally, not all threats originate outside the firewall and can come from within the network. Further, firewalls themselves are subject to attack, which can render the firewall ineffective.
Therefore, networks need to rely on resources other than firewalls for network security. Such resources include vulnerability detection tools and intrusion detection tools. Vulnerability detection tools perform examinations of a network to determine weaknesses in the network that might allow security violations—in other words, they determine where in a network an attack is possible. Similarly, intrusion detection tools monitor a network for intrusive traffic and notify a network administrator of suspicious traffic so that corrective action can be taken.
Nonetheless, vulnerability detection systems and intrusion detection systems are inherently complex and typically lack interoperability. Security engineers need to know what types of attack signatures to look for, how to look for them, and how to respond to an identified attack. But typically, the intrusion detection system cannot obtain an accurate picture of the network and cannot leverage off of the risk analysis conducted by the vulnerability detection system. As a result, a great burden falls upon the security engineer responsible for the network configuration. The security engineer must also constantly examine extensive log data generated from other devices, as well as remain aware of changes occurring within the network. Moreover, such intrusion detection systems frequently burden security engineers with false alarms—alerting the security engineer to traffic that is not harmful to the present system, although it may be harmful to other systems.
To further burden the security engineer, each vulnerability or potential intrusion needs to be identified and a description of it stored for use by the vulnerability or intrusion detection tools. This process, however, is often complicated. For instance, it is extremely difficult just to write an application that would check a Secure Shell server to determine if the remote system was running a version of SSH that is vulnerable to a Denial of Service attack. Traditional development methodologies force the user to have an intimate understanding of TCP/IP and a low-level (often cumbersome) development language such as ANSI C or Perl. Even advanced “Attack Scripting Languages” are overly cumbersome and require an understanding of variables, “for” loops, “while” loops, and other development syntax.
Thus, there is a need to develop a vulnerability detection system and intrusion detection system that can leverage off one another. Further, there is a need to perform vulnerability and intrusion identification and description that is usable by typical network engineers.